Intuition behind evaluating attack performance on data not in the training set

It seems like when creating the attack data, those in the training set are set as 0 and not in the training set are set as 1:
https://github.com/tensorflow/privacy/blob/caf71c11bcdf3f6301db6916a37901b22798c992/tensorflow_privacy/privacy/membership_inference_attack/models.py#L78-L79
https://github.com/tensorflow/privacy/blob/caf71c11bcdf3f6301db6916a37901b22798c992/tensorflow_privacy/privacy/membership_inference_attack/membership_inference_attack.py#L85-L88
In this way, the attack performance (auc and advantage) is evaluated on the data that are not in the training set instead of data in the training set, as pos_label for tpr and fpr in metrics.roc_curve is 1 by default.

I feel like most lieterature evaluates attack performance on the data in the training set instead as people want to see how well an adversary can distinguish if a sample is in the training set. Is there a specific reason for evaluating on the data that are not in the training set here?

Start with the linked sections of tensorflow_privacy/privacy/membership_inference_attack/models.py and membership_inference_attack.py, then trace how labels reach metrics.roc_curve and its default pos_label. Done means establishing whether the label convention intentionally evaluates non-members or whether the attack metrics should represent membership in the training set.